While there is no U.S. law that expressly requires consent to deploy cookies, there continues to be an influx of litigation, arbitration, and class action claims under federal and state wiretapping laws. These actions claim that companies violate such laws when third-party cookies, pixels, and other automated tracking technologies (e.g., Meta Pixel, LinkedIn pixel, etc.) are deployed without consent. These claims are being brought most aggressively in California under the California Invasion of Privacy Act (CIPA), which offers a private right of action and imposes potential statutory damages of $5,000 per violation. However, these claims have also been brought in other states, both on a federal and state level, with varying levels of success. For example, some states have ruled favorably to the website owner, such as Massachusetts' Supreme Judicial Court holding that using third-party website technologies (including Google Analytics and Meta Pixel) does not violate the Massachusetts Wiretap Act. In other states, including California, there are still conflicting outcomes in the courts.
Inconsistencies in the courts' application of CIPA may be contributing to plaintiff firms' focus on bringing claims in California. California legislators recently introduced a bill to curb abuse of CIPA, and while passing this bill would likely result in a reduction of CIPA claims, there may also be a surge in CIPA demands as a result. Further, the California Consumer Privacy Act (CCPA) provides a limited private right of action for data breaches, and a California court recently allowed claims involving the unauthorized disclosure of personal information via tracking technologies to proceed, despite the absence of any traditional data breach. This decision could allow for further litigation, arbitration, and class action claims related to use of third-party cookies, pixels, and other tracking technologies under CCPA and CIPA.
Entities with active websites that use third-party cookies, pixels, and other automated tracking technologies should be aware of the risks related to using such technologies, particularly in California. The most effective way to combat these claims is to implement a GDPR-style cookie consent banner that collects express consent before deploying such technologies. However, this type of banner may also meaningfully reduce the ability to deploy cookies that entities rely on for website analytics, marketing, etc. At a minimum, we recommend that website owners (1) conduct a review of any third-party cookies, pixels, and other tracking technologies active on your websites; (2) review and update website privacy policies to ensure they accurately and completely describe the use of such technologies; and (3) implement a cookie banner that clearly notifies website visitors of the website's cookie practices, with a link to the privacy policy, and ideally with the opportunity to adjust cookie settings. A plaintiff may still argue that there is an actionable claim if third-party technologies are enabled before consent is obtained, but providing notice at least creates an argument of implied consent.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
